How to deal with authentication for a Ruby API wrapper?

Question

I'm working on an API wrapper for Viddler, which will eventually be made public, and I'm trying to figure out the best way to deal with authentication/API keys, specifically with usage within Rails applications in mind.

The easiest way to write the wrapper would be to just have the code create a new client each time, and the developer could store the API key in a constant for future use:

@client = Viddler::Client.new(VIDDLER_API_KEY)

The problem with this is, it's kind of clunky to have to keep creating client objects and passing in the API key. This gets even more complicated when you throw user authentication into the mix.

I'm thinking some sort of solution where I all the the API key to be set in the environment file and then the authentication would be done in a before_filter.

Viddler::Client.api_key = 'abc123'
Viddler::Client.authenticate! 'username', 'password'

Viddler::Client would then store this in a class variable, and you could call Viddler::Client.new without any parameters and make authenticated calls. One thing I'd be concerned about is that this means the developer would have to be sure to clear out the authentication before or after each request, since the class variables would persist between requests.

Any thoughts?

Answer 1

Storing the API key globally would for sure be pretty useful and certainly is the way to go for that kind of information. User authentication on the other hand I think shouldn't be stored globally, never ever, especially for a high level API, because telling your users to "ensure to add an after_filter :reset_viddler_auth" might lead to some unexpected security risks.

# in a config/initializer/*.rb file or something
Viddler::Client.api_key = "abc123"

# in the controller/action/model/wherever
@client = Viddler::Client.new # anonymous
@client.authenticate!("username", "password") # authenticate anon client

@client_auth = Viddler::Client.new("username", "password") # authenticated client

Guess like that you've best of both worlds :) Maybe even provide a way to create a new client with another API key like,

@client_other = Viddler::Client.new("username", "password", :api_key => "xyz890")

So... just my 2 cents.

PS: not sure how up-to-date it is, but there's already a ruby viddler wrapper, just FYI, http://viddler.rubyforge.org/rdoc/